virus infection - McAfee missed it - here is desc and fix

[asdf1234]

Environment:

Sony VAIO laptop. 64-bit. Windows 7.

Characteristics:

Not detectable via full scan by McAfee

Current user is the only one affected. Must be in AppData?

No executables can be started except IE-8 and McAfee. Msg is “Application cannot be executed. The file somename.exe is infested. Do you want to activate your antivirus software now?”

IE-8 for almost every site shows msg, “IE warning – visiting this website may harm your computer” followed by recommendation to go to virus detection web site. That is at antivirpwr.com where they prompt you to buy their software.

IE-8 is sent to porn sites.

Popup occurs constantly: “Infiltration alert”

Another popup occurs constantly: “Attention, spyware alert” and says you have 13 (or some large number) of viruses in you system. Run a full scan now?”

Picked up on 9/13/2010 either from Skype or Facebook

To FIX

Files added to users/username/AppData/Local:

• ·        1029806827.exe
• ·        Edoligejope.dll
• ·        Etucemucorojewu.dll
• ·        Igipayukayej.dll
• ·        Ilepefoqesoda.dll
• ·        Ljotiyifaniv.bin
• ·        Mvuqujid.dat
• ·        Orefatuf.dll
• ·        Ovukuyepebeham.dll
• ·        Uzuraxonug.dll
• ·        Wicms032.dll
• ·        Folder qgorvuowk

Moved those files to temp directory.

Now at startup “cannot execute AppData\Local\wicms032.dll and uzuraxonug.dll. Popups are not coming up. IE still cannot display any web pages but other messages are removed.

Used msconfig for cleanup of startup:

3 lines turned off:

1.      Wrikerudanesum  rundll32.exe “…\local\wicms032.dll”, startup

2.      Pcuinllh …\local\qgorvuowk\jkinmpbugiw.exe

3.      Mtonowukazagawic rundll32.ee “…\local\uzuraxonug.dll”, startup

On restart the error messages disappeared.

IE still cannot display web pages.

FireFox is OK. Note that proxy incorrectly set to manual 127.0.0.1 port 6092. Reset to no proxy.

In IE8 at tools. Reset to factory default, deleted all cookies and history.

Now it works.

[jljjr27]

I have the virus also and using windows xp, can anyone tell where I would find these files. Thank you in advance for any and all help,

[smbslt99]

I don't have the appdata folder under the username. There is one at the same level as username, but it doesn't include the listed files.

Any suggestions?

[asdf1234]

The AppData folder is hidden. Go to Control Panel, Folder Options, View, and check "show hidden files and folders"

[k3tg · Accepted solution]

This document from McAfee will assist you in resolving your issue(s)

When you have completed the steps in the document and if you still are not able to get back up and running try the free version of this tool http://www.malwarebytes.org/mbam.php You may need to download this on a non infected pc onto a usb stick and you should rename the download and installation folders to something you can easily remember since virus and malware are written to self protect themselves. When you get it installed check for the latest updates and run the program and let it clean everything it finds and reboot the computer if you are prompted to do so.

SuperAntispyware is also a good one to have and it catches a lot of stuff as well. Just follow the same procedure as above. www.superantispyware.com

Let us know if this works for you.

[macmasterson]

I have XP and none of the previous describe fixes worked.  I downloaded rkill, and malware scanner, rebooted in safe mode and followed all instructions.  McAfee did not stop the malware, nor could it find in in complete scan.  The malware software did a full scan and did not fix the problem.  THE ONLY THING THAT WORKED WAS TO USE THE WINDOWS RESTORE FUNCTION TO A DATE PREVIOUS TO THE PROBLEM.